The LapseZero alternative that watches what your server serves

LapseZero is a certificate lifecycle tool. It issues certificates through ACME with DNS-01 validation across a long list of DNS providers, deploys them to cloud and server targets with one click, and renews them on a schedule, all from one console. Its free tier covers 3 domains, 5 deployment targets and 5 certificate monitors, and it alerts at 60, 30, 15, 7, 3 and 1 day before expiry. If your problem is that certificates are issued and deployed by hand across several clouds, it solves that problem, and this page will not pretend otherwise.

CertPost does a different job, and the two are not exclusive.

What is on the wire. A lifecycle tool knows what it issued and where it deployed. It does not know what a visitor's browser receives after a load balancer, a CDN, a second address behind the same name, or a server that renewed on disk and never reloaded. CertPost reads the served certificate from outside on every check: expiry, the full chain with its intermediates, hostname and SAN match, on any TLS port including mail and admin ports, over IPv4 and IPv6. When the certificate on the wire is not the one that was issued, that is the alert.

When a renewal did not happen. Let's Encrypt and Google Trust Services publish, for every certificate they issue, the window in which they want it renewed. CertPost reads that window and tells you when it closes with the same certificate still served, which lands weeks before an expiry countdown starts. It also reads Certificate Transparency, so a certificate issued for your name that never reached the server, or one issued by a CA you did not expect, gets reported.

Hosts a lifecycle tool cannot reach. A firewall, a load balancer, an appliance or a partner's server that you do not control still has a certificate that expires. CertPost only needs the host to be reachable from the internet; nobody has to install anything or hand over DNS credentials.

Price. CertPost is 3 certificates free forever, then a flat $29/month for unlimited certificates. The count of hosts, targets or clouds does not change the bill.

If you want one console to issue and deploy certificates across clouds, LapseZero is built for that. If you want to know, every day, that the certificate each host actually serves is the right one, and to hear the day a renewal is late rather than the week it expires, that is CertPost. Teams that run both put the lifecycle tool in front and the monitor behind it, because the failures that reach users happen after the renewal reports success.